ChatGPT is already in your clinic — nobody just admits it
Let's be honest about what actually happens in aesthetic clinics. Between two consultations, a physician pastes a note into ChatGPT to tidy it up. The front desk asks it for a follow-up letter. In the evening, someone has it draft a reply to a Google review or rework a quote. The tool is fast, nearly free, and genuinely impressive. The problem is never the artificial intelligence itself — it is what you feed it. The moment an identifying detail lands in that chat box, ChatGPT and patient-data compliance stops being a theoretical concern and becomes a real one.
This article won't tell you to stop using AI. That ship has sailed, and no one would listen anyway. Instead, it draws the line: what you can safely do with a consumer tool, what must never go into it, and the compliant way to go further. If you want the wider picture of what an AI assistant actually does in a clinic, start there. Here we focus on a single, very common risk — the patient detail that leaks out the wrong door.
Where does the data you type into ChatGPT really go?
When you type into a consumer assistant, the text does not stay on your iPhone. It travels to the provider's servers, most often hosted in the United States, it is processed there, and depending on your account settings it may be reused to improve the models. In other words, information you assumed was fleeting can be retained and re-read, outside the European Union and outside your control. For a marketing paragraph, that is harmless. For a patient name tied to a medical history, it is a disclosure of health data to a third party, with no framework around it.
This is not a lawyer's paranoia. Europe's data-protection authorities have looked closely at these tools: the European Data Protection Board's ChatGPT taskforce report documented the grey areas around lawful basis, transparency and data accuracy. A clinic that pours patient information into such a tool is not merely taking a hypothetical risk — it loses control over the purpose and the location of that data, two cornerstones of the GDPR. In the United States, the equivalent point is that consumer ChatGPT sits outside any Business Associate Agreement, so it is not HIPAA-compliant for protected health information either.
What you CAN do with ChatGPT
Here's the reassuring part: most of the tasks where AI saves you time touch no patient data at all. As long as nothing can re-identify a person, a consumer tool is perfectly usable. A clinician can hand it, with a clear conscience:
- Generic marketing content: a blog draft, an Instagram caption, a phone greeting script, an "about us" page.
- Rewriting and editing: making a treatment-information paragraph clearer, fixing a template email, translating a welcome document.
- Plain-language explanations: describing how botulinum toxin or hyaluronic acid works, to feed your patient education material.
- Blank templates: the structure of a quote, the outline of a satisfaction survey, a newsletter plan — with no real name or case attached.
The rule fits in one sentence: if you could pin the text to your waiting-room wall without embarrassing anyone, you can give it to ChatGPT. As soon as the answer becomes "no," switch tools.
What you CANNOT do
Anything that identifies a patient, directly or indirectly, is off-limits in a consumer assistant — and that covers more cases than people expect:
- Pasting a real consultation note, even with the first name changed: age, history and treatments combined are often enough to re-identify.
- Dictating a named consultation to get a summary.
- Uploading a before-and-after photo or a record for analysis.
- Copying a patient's message describing symptoms to draft the reply.
Why so strict? Because health data is not ordinary data. The GDPR treats it as a "special category" under Article 9 of the Regulation: processing it is prohibited in principle, save for specific grounds. Layered on top is medical confidentiality, which forbids disclosing health information to an unauthorised third party — and a consumer AI server is, legally, a third party. Quickly "anonymising" by deleting the name is not enough: re-identification stays possible, and the liability stays yours. For the full set of obligations, our guide to GDPR and patient data in aesthetic medicine and the Nextmotion compliance page go deeper.
The compliant path: AI in a controlled environment
Banning AI in the name of compliance would mean giving up a real time saving. The right answer isn't "no AI," it's "the right AI, in the right place." What separates a forbidden tool from a compliant one isn't the model — often much the same — but the setup: where the data is hosted, for what purpose, under which contract. Two paths make sense for an aesthetic clinic.
1. AI built into your clinical software
This is the approach of Jarvis, the Nextmotion AI. During a consultation, it listens, produces a structured report and generates the quote line items — the clinician reviews and confirms, and nothing is sent without approval. The decisive difference from ChatGPT: everything stays in a space partitioned per clinic, on infrastructure built to meet the requirements of HDS, the French health-data hosting framework overseen by the national digital health agency (Agence du numérique en santé). The data never leaves the clinical setting. Our article on the digital consultation in aesthetic medicine walks through that flow.
2. Self-hosted AI
For clinics that want to keep everything in-house, the Nextmotion VPS hosts the clinic website, n8n automations and your AI agents on a private server, with data in Europe, on infrastructure built to meet HDS and GDPR requirements. Your agents run around the clock without routing a single record through a consumer cloud. It is the direct answer to "where does my data go": it doesn't move.
FAQ — ChatGPT and patient data
Is ChatGPT HIPAA compliant?
The consumer version is not: OpenAI does not sign a Business Associate Agreement for it, so it cannot lawfully process protected health information. The same logic applies under the GDPR in Europe. Generic content with no patient data is fine; real patient information needs a tool bound by the appropriate healthcare framework.
Can I put patient information into ChatGPT?
No — not into a consumer assistant. Any detail that can identify a patient (name, history, photo, a real note) is health data, and typing it into a public AI discloses it to a third party outside your control. Use AI that is embedded in secure clinical software instead.
Do AI chatbots store the data you type?
Consumer chatbots process your inputs on the provider's servers, usually in the US, and depending on your settings may retain them and reuse them to improve the models. You lose control over where the data lives and what it is used for — both central GDPR principles.
What is a compliant alternative to ChatGPT for clinics?
AI built into your clinical software, hosted in an environment designed for health-data requirements and partitioned per clinic, or AI self-hosted on your own server. In both cases the health data stays in a controlled environment and you keep the final say on every action.
Keep the AI, protect the record
You don't have to choose between saving time and protecting patient confidentiality. Generic AI stays valuable for everything that never touches a patient; the rest deserves a tool built for healthcare. Nextmotion helps aesthetic clinics put AI to work without ever exposing a patient record. Request a demo and see, on your own workflow, exactly where the line sits — and how to hold it without slowing your clinic down.
